17422 matches found
mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user
A vulnerability was found in mariadb and in the mysql wsrep patch that allows remote code execution. A user with SUPER privileges could execute arbitrary shell commands in the context of the mariadb server process...
The vulnerability of the web interface of the Cisco HyperFlex virtual machine installer allows a attacker to execute arbitrary commands on the target system with root user privileges.
The vulnerability of the Cisco HyperFlex virtual machine installer’s web interface is related to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the target system with...
The vulnerability of Adobe Connect’s instant messaging program, related to the lack of protective measures for the website structure, allows a hacker to execute arbitrary JavaScript code in the user’s browser.
The vulnerability of the Adobe Connect instant messaging program relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...
The vulnerability of the Redis database management system, related to writing beyond the buffer in memory, allows a perpetrator to perform arbitrary operations.
The vulnerability of the Redis database management system is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using the STRALGO LCS command...
python-lxml: mXSS due to the use of improper parser
A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat...
PT-2021-19242 · Unknown · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection issue, which can lead to root Remote Code Execution. Recommendations: At the moment, there ...
PT-2021-3670 · Xstream +5 · Xstream +5
Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.17 Description: A vulnerability in XStream may allow a remote attacker with sufficient rights to execute commands of the host by manipulating the processed input stream. The issue is related to shortcomings in th...
CVE-2020-20092
File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...
Unrestricted file upload
File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code...
CVE-2020-20092
ArticleCMS 1.0 is vulnerable to a file-upload flaw in the image-upload feature at /admin. By spoofing Content-Type: image/jpeg and appending PHP code after the JPEG data, a remote attacker could execute arbitrary PHP code. This claim is consistent across multiple connected records (e.g., Red Hat,...
KonaWiki SQL注入漏洞
KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping minutes and memos, etc. A SQL injection vulnerability exists in KonaWiki2 prior to version 2.2.4. The vulnerability stems from the program not performing sufficient cleansing of user-supplied data...
CVE-2020-19274
A Cross SIte Scripting XSS vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code...
CVE-2020-19274
A Cross SIte Scripting XSS vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
Visual Studio Code Remote Code Execution Vulnerability
...
PT-2021-3014 · Microsoft · Exchange Server
Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Exchange Server. It allows a remote attacker to execute arbitrary code. Recommendations: At the...
Microweber CMS 1.1.20 Remote Code Execution
Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution Authenticated Date: 2020-10-31 Exploit Author: sl1nki Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/tree/1.1.20 Version: " . shellexec$REQUEST"fexec" . ""; ?' Notes: SSL verification is...
PT-2021-6857 · Fortinet · Fortiswitch +7
Name of the Vulnerable Software and Affected Versions: FortiOS versions prior to 7.0.1 FortiWeb versions affected versions not specified FortiSwitch versions affected versions not specified FortiProxy versions affected versions not specified FortiADC versions affected versions not specified Forti...
CVE-2021-31450
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...